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Introduction 


1. The Freedom of Information Act 2000 (FOIA) gives rights of 
public access to information held by public authorities. 


2. An overview of the main provisions of FOIA can be found in The 
Guide to Freedom of Information. 


3. This is part of a series of guidance, which goes into more detail 
than the Guide, to help public authorities to fully understand 
their obligations and promote good practice. 


4. This guidance explains to public authorities how the exemption 


in Section 41 works to protect information provided in 
confidence. 


Overview 


e Section 41 sets out an exemption from the right to know where 
the information was provided to the public authority in 
confidence. 

e Information will be covered by Section 41 if; 

o it was obtained by the authority from any other person, 


o its disclosure would constitute a breach of confidence. 


o alegal person could bring a court action for that breach of 
confidence, and 


o that court action would be likely to succeed 


e When determining if disclosure would constitute a breach of 
confidence, the authority will usually need to consider; 


o whether the information has the quality of confidence, 


o whether it was imparted in circumstances importing an 
obligation of confidence, and 


o whether disclosure would be an unauthorised use of the 
information to the detriment of the confider. 


e If the information concerns the confider’s private life, then the 
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authority won’t have show detriment as this can be assumed. 


e When determining if an action for breach of confidence would be 
likely to succeed, the authority will need to consider whether 
there would be a public interest defence to the disclosure. 


e Section 41(2) provides an exclusion from the duty to confirm or 
deny whether information is held. This exclusion applies if 
confirming or denying that information is held would in itself give 
rise to a breach of confidence, actionable by any person, that 
would be likely to succeed. 


5. Section 41 sets out an exemption from the right to know where 
the information was provided to the public authority in 
confidence. 


6. Itis designed to give those who provide confidential 
information to public authorities, a degree of assurance that 
their confidences will continue to be respected, should the 
information fall within the scope of an FOIA request. 


What FOIA says 


7. Section 41(1) states: 


41.—(1) Information is exempt information if — 


(a) it was obtained by the public authority from any other 
person (including another public authority), and, 


(b) the disclosure of the information to the public 
(otherwise than under this Act) by the public authority 
holding it would constitute a breach of confidence 
actionable by that or any other person. 


8. In order for Section 41 to be engaged, the following criteria 
must be fulfilled: 


° the authority must have obtained the information from 
another person, 


° its disclosure must constitute a breach of confidence, 
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10. 


e a legal person must be able to bring an action for the 
breach of confidence to court, and 


e that court action must be likely to succeed. 


Section 41(1)(b) stipulates that disclosure must constitute an 
actionable breach of confidence, ‘otherwise than under this 
Act’. This means that an authority cannot rely on the FOIA as a 
justification for releasing confidential information if to disclose 
it under any other circumstances would give rise to an 
actionable breach of confidence. 


We will now address the above criteria in more detail. 


The authority must have obtained the information from 


another person 

11. Section 41(1)(a) requires that the requested information must 
have been given to the authority by another person. 

12. In this context the term ‘person’ means a ‘legal person’. This 
could be an individual, a company, another public authority or 
any other type of legal entity. 

13. It follows that the exemption won't cover information the 


authority has generated itself, although it may cover 
documents (or parts of documents) generated by the public 
authority if these record information provided in confidence by 
another person, for example: 


e A transcript of the verbal testimony given by an employee 
at an internal disciplinary hearing. 


e A set of minutes that record the views expressed by a 
contractor during a meeting with the authority. 


2 A written note detailing a conversation with a member of 
the public that took place over a confidential advice line. 


G A doctor’s observations of a patient’s symptoms, recorded 
during a consultation. 


e An x-ray image of a patient taken by a hospital. 
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Example 


In Department for Business, Enterprise and Regulatory Reform 


(DBERR) v ICO and Friends of the Earth (EA/2007/0072, 29 
April 2008) the requester had requested material relating to 


meetings and correspondence between ministers/senior civil 
servants at DBERR and the CBI. 


DBERR provided some of the information but applied Section 
41 and several other exemptions to material about the 
meetings. 


The Tribunal accepted that the records of the meetings 
contained information obtained from another party, even 
though the actual material itself was created by the DTi 
(DBERR’s predecessor). 


In reaching this conclusion, the Tribunal considered the 
implications of taking the opposing view - that information 
recorded from another party isn’t covered; 


‘highly confidential information passed by an informant to a 
police officer would be protected if it was recorded in a letter 
sent to the police by that source, but would not be protected if 
the police officer met the source, had a conversation, and then 
recorded it in a memorandum or statement. This privileges the 
accident of form (or record) over content, and cannot be 
correct...’ (Para 78) 


14. If the requested material contains a mixture of both 
information created by the authority and information given to 
the authority by another person, then, in most cases, the 
exemption will only cover the information that has been given 
to the authority. 


Example 


A police authority sends a government department a copy of a 
confidential report. 


Upon receiving the report, the department adds its own 
analysis, interpretation and comments to the document. 


If the department was to receive an FOI request for this 
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15. 


16. 


17. 


document then the content produced by the police authority 
would be covered by Section 41(1)(a) by virtue of being 
obtained from ‘another person’. 


However, the department’s added analysis, interpretation and 
comments would fall outside the scope of the exemption 
(subject to the paragraph’s below) having been created by the 
department itself. 


However, the authority must also consider whether the 
disclosure of the information it created would reveal the 
content of the information it obtained from the other person. If 
it would then the exemption may also cover the material it 
generated itself. 


This could occur if the authority’s own analysis, interpretation 
or comments are very specific to the information received from 
that person. An example of this might be where the request is 
for medical or social care records. In these circumstances both 
the information about the patient’s/client’s symptoms and the 
relevant medical or social care professional’s assessment of 
those symptoms may be deemed to have been obtained from 
the patient/client for the purposes of Section 41(1)(a). 


Example 


An individual makes an FOI request to a psychiatric hospital 
for a copy of his daughter’s medical records from her time at 
the institution. 


The material caught by the request includes a psychiatrist’s 
observations of his daughter’s behaviour and his diagnosis of 
her condition, based on those observations. 


In this case, both the psychiatrist’s observations and the 
diagnosis would be caught by the scope of Section 41(1)(a), 
because disclosing the psychiatrist’s diagnosis would inevitably 
reveal confidential information obtained from the patient. 


Information relating to contracts 


The contents of a contract between a public authority and a 
third party generally won’t be information obtained by an 
authority from another person. 
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18. This is because the terms of the contract will have been 


19. 


20. 


2i. 


mutually agreed by the respective parties, rather than provided 
by one party to another. 


Example 


In Department of Health v ICO (EA/2008/0018, 18 November 
2008) the requester had asked for a copy of a contract 
between the Department of Health (the DOH) and a company 
called Methods Consulting Limited. 


The DOH refused this information under Sections 41 and 43 of 
the FOIA. 


The requester subsequently raised a complaint with the 
Commissioner, who ruled that the Section 41 was not engaged 
because the information in the contract was not obtained from 
another party. 


The Tribunal agreed that the contract didn’t fulfil the 
requirements of Section 41(a), stating; 


‘If the Contract signifies one party stating: “these are the 
terms upon which we are prepared to enter into a Contract 
with you” by the acceptance of that Contract the other party is 
simultaneously stating “and these are the terms upon which 
we are prepared to enter into a Contract with you”. 
Consequently the Contract terms were mutually agreed and 
therefore not obtained by either party’ (Para 34) 


However, we recognise that in some cases a contract will 
contain technical information, given to the authority by the 
other party to the contract, in addition to the mutually agreed 
terms and obligations. Sometimes the technical material will 
form part of main body of the contract, although more often 
than not it will feature in separate schedules. 


Where technical information is included, it may, depending on 
the circumstances of the case, constitute information obtained 
by the authority from another person. 


If the contract contains information relating to the other party’s 
pre-contractual negotiating position, then this could also qualify 
as information obtained from another person, although once 
again this will depend on the individual circumstances of the 
case. 
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The disclosure of the information must constitute a breach 
of confidence 


22. We would advise authorities to use the test of confidence set 


23. 


24. 


25. 


26. 


27. 


28. 


out by Judge Megarry at the High Court of Justice in Coco v A N 
Clark (Engineers) Limited [1968] FSR 415 as a framework for 
assessing whether a disclosure would constitute a breach of 
confidence. 


Judge Megarry suggested that three elements were usually 
required to bring an action for a breach of confidence: 


e the information must have the necessary quality of 
confidence, 


e it must have been imparted in circumstances importing an 
obligation of confidence, and 


e there must have been an unauthorised use of the 
information to the detriment of the confider. 


However, authorities should take note that the law of 
confidence in respect of information on private matters has 
evolved since the Coco v Clark case. 


Of particular significance was the introduction of the Human 
Rights Act 1998 (HRA), and more specifically Article 8 of that 
legislation which gives everyone the right to respect for their 
family and private life. 


Once this came into force the courts recognised that the 
confider’s Article 8 rights would have to be incorporated into 
the test of confidence. 


This was acknowledged in the Court of Appeal in Mckennitt V 
Ash [2006] EWCA Civ 1714 when Lord Justice Buxton stated; 


‘in order to find the rules of the English law of breach of 
confidence we now have to look in the jurisprudence of articles 
8 and 10. Those articles are now not merely of persuasive or 
parallel effect but...are the very content of the domestic tort 
that the English court has to enforce...’ (Para 11) 


These developments in case law aren’t incompatible with Judge 
Megarry’s test. However, they do mean that authorities should 
pay appropriate regard to the requester’s right to privacy anda 
family life when considering each of the test’s three limbs. This 
is addressed in more detail in the sections below. 
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The necessary quality of confidence 


29. 


30. 


3i. 


32. 


Information will possess the necessary quality of confidence if; 


e it is more than trivial; and 


° not otherwise accessible. 


The information should be worthy of protection in the sense 
that someone has a genuine interest in the contents remaining 
confidential. 


It does not have to be highly sensitive, but nor should it be 
trivial. The preservation of confidences is recognised by the 
courts to be an important matter and one in which there is a 
strong public interest. This notion could be undermined if even 
trivial matters were covered. 


However, otherwise trivial information should be treated as 
more than trivial if; 


e it relates to a personal matter; and 


e the confider or the person who the information is about 
obviously attaches some importance to that information. 


Example 


In S v ICO and the General Register Office (EA/2006/0030, 9 
May 2007) S had asked The General Register Office (GRO) for 


information connected to the registration of a relative’s death. 


The GRO released some information but applied Section 41 to 
a letter it had received from the deceased’s partner confirming 
her whereabouts at the time of his death. 


In the subsequent appeal, S argued that the withheld letter 
was trivial in nature. However, the Tribunal ruled that the 
information couldn’t be trivial because of the importance that 
the deceased’s partner attached to it. 


‘It is clear...that the Informant has attached a great deal of 
emotional significance to this information and that she feels 
that to have it disclosed by a third party against her wishes 
would cause her distress. On this basis we are satisfied that to 
the Informant it is clearly information worthy of protection...’ 
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33; 


34. 


35. 


36. 


37. 


38. 


(Para 36) 


`..We deal at this stage with the “defence” to an actionable 
breach of confidence raised by the Appellant namely that...the 
law will not concern itself with trivialities...Information cannot 
be said to be trivial if it is of importance to the person whose 
privacy has been infringed...Having seen the disputed 
information and for the reasons set out above we are satisfied 
that the information contained within the disputed information 
is not “trivial” or tittle tattle...’ (Para 37) 


If the information is more than trivial then the authority must 
go on to consider whether the information is otherwise 
accessible. 


Information that is already in the public domain won't possess 
the necessary quality of confidence. 


This reflects the position taken by Judge Megarry in Cocov A N 
Clark (Engineers) Limited [1968] FSR 415 where he stated; 


"there can be no breach of confidence in revealing something 
to others which is already common knowledge.” 


Information will be in the public domain if it is realistically 
accessible to the general public at the time of the request. This 
is a matter of degree and will depend on the specific 
circumstances of the case. For further explanation on this point 


please see our guidance Information in the public domain 


In the case of commercial confidentiality, we consider that 
confidentiality will be permanently lost if the information has 
entered the public domain at any time, even if the material is 
no longer in the public domain at the time of the request. 


If information on the same subject matter as the request does 
already appear to be in the public domain, the authority will 
still need to carefully consider the scope of the request and 
exact content of the withheld material to establish whether 
disclosure would reveal anything new. 


For example, the material held by the authority may be more 
detailed than the information already in the public domain, 
corroborate a previously unreliable source or leak, or give a 
previously unknown context to the information. 
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39. 


40. 


If disclosure would reveal something new, then the material 
that would bring the new information to light may still retain its 
quality of confidence. 


Example 


In Bluck v ICO and Epsom and St Helier University NHS Trust 
(EA/2006/0090, 17 September 2007), the requester had 


asked the Trust for all the information it held about her 
deceased daughter, including medical records. The Trust 
considered this information to be confidential and withheld it 
under Section 41. 


In the subsequent Tribunal case, the requester’s counsel 
argued that medical records had lost the required quality of 
confidence because much of the information had already 
passed into the public domain (for example through court and 
press statements). 


Upon inspecting the withheld information, the Tribunal 
concluded that the records contained information beyond that 
which was already in the public domain, and ruled that this 
undisclosed material had retained the necessary quality of 
confidence. 


‘We have [inspected the Medical records] and have concluded 
that they contain a certain amount of information, beyond that 
contained in earlier correspondence, press statements and 
court documents disclosed to the Appellant without restriction. 
In our view that body of non-disclosed information retains the 
necessary quality of confidence...” (Para 16 ) 


Confidential information that was only disseminated to a limited 
number of recipients can retain its quality of confidence, 
provided that none of the recipients subsequently released the 
material into the public domain themselves. 


Example 


In S v ICO and the General Register Office (EA/2006/0030, 9 
May 2007), S had argued that the withheld letter wasn’t 


confidential because she was already aware of its contents. 
However, the Tribunal rejected this line of reasoning. It 
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stated; 


‘The Appellant argues that the information cannot be 
considered confidential because it must be inaccessible in the 
sense of not being in the public domain. The Informant has 
said (as set out above) “there is nothing in this letter that [the 
Appellant] was not already aware of’. (Para 38) 


‘The Tribunal asks itself the question, does the information 
lose its quality of confidentiality if it is information already 
known to the applicant independently? In answering the 
question in the negative, the Tribunal takes into account the 
arguments set out in paragraph 38 above, namely 

that information in the public domain loses the quality of 
confidentiality but dissemination to a limited number of people 
does not stop information from being considered to be 
confidential’. (Para 78) 


41. The same principle will also apply if the information was 


disseminated to others on the condition that it was for their use 
alone. 


Example 


A university provides a government department with a report 
into some new medical research it has carried out. 


The university informs the department that the report is 
confidential, as the contents are commercially sensitive and 
have yet to be published. 


The department disseminates the report to a selection of 
independent scientific experts for their views on its contents. 
However, it does so on the condition that the experts will only 
use the report for their own purposes and won't share the 
contents with anyone else. 


As the department provided the report to experts on the 
understanding that it was for their use alone, the contents of 
that report would still retain the necessary quality of 
confidence. 


42. The fact that part of the requested information, or similar 


material, has been disclosed in the past shouldn’t be taken as 
12 
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definitive proof that the undisclosed requested information 
doesn’t have the necessary quality of confidence. 


43. For example, the previous disclosure could have been due to an 
error, or a failure to follow good practice, as in the Tribunal 
case below. 


Example 


In S v ICO and the General Register Office (EA/2006/0030, 9 
May 2007), S made the point that information she had 
provided to the GRO had been disclosed in similar 
circumstances. In her view, this proved that the withheld 
letter wasn’t subject to a duty of confidence. 


However, the Tribunal viewed that disclosure as indicative of 
poor practice by the GRO, rather than evidence that the letter 
lacked the necessary quality of confidence. 


‘.. The inconsistency of approach in this case appears to be 
indicative of a lack of good practice and/or understanding of 
the scope and remit of FOIA within the GRO rather than 
evidence that there is no duty of confidentiality.’ (Para 86) 


The obligation of confidence 


44. The second limb of Judge Meggary’s test is concerned with the 
circumstances in which the confider of information passed it on. 


45. There are essentially two circumstances in which an obligation 
of confidence may apply: 


e The confider has attached explicit conditions to any 
subsequent use or disclosure of the information (for 
example in the form of a contractual term or the wording 
of a letter); or 


° The confider hasn't set any explicit conditions, but the 
restrictions on use are obvious or implicit from the 
circumstances. For example, a client in therapy wouldn't 
need to tell their counsellor not to divulge the contents of 
their sessions to others, it is simply understood by both 
parties that those are the rules. 
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46. 


47. 


48. 


49. 


50. 


5i. 


Explicit conditions are most commonly used in connection with 
commercial information, (for example, confidentiality clauses in 
the terms of a contract). However, it is equally possible for a 
confider to attach explicit conditions to the provision of other 
types of information. 


Some of the circumstances which typically give rise to an 
implicit obligation of confidence are reasonably well known, for 
instance, where information is provided in the context of the 
relationship between: 


° a patient and doctor; 

° a client and lawyer; 

° a penitent and priest; 

° a customer and bank; or 


° a client and social worker. 


Other circumstances can be more difficult to pin down. For 
instance, employees clearly have obligations of confidence 
towards their employees, although these are not all 
encompassing. Whilst it is fairly obvious that information 
contained in staff appraisals should not be disclosed, other 
information, such as names and job titles, is unlikely to be 
confidential. 


Authorities should also keep in mind that there is more scope 
for uncertainty and misunderstanding when an obligation of 
confidence is implicit because there is always a risk that the 
expectations of the confider and the authority may be different. 


If an authority is unsure whether any implicit obligation of 
confidence exists, then it may find it helpful to apply the 
‘reasonable person’ test used by Judge Megarry in Coco v A N 
Clark (Engineers) Limited [1968] FSR 415. 


Judge Megarry advocated that; '...if the circumstances are such 
that any reasonable man standing in the shoes of the recipient 
of the information would have realised, that upon reasonable 
grounds the information was being given to him in confidence 
then this should suffice to impose upon him the equitable 
obligation of confidence’. 
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52. If the authority is still in any doubt, then it would be best 
advised to seek the views of the parties who would be affected 
by the disclosure of requested information. 


53. Some examples of cases where the Tribunal has accepted that 
there was an implied obligation of confidence are provided 
below. 


Example 


In S v ICO and the General Register Office (EA/2006/0030, 9 
May 2007) the withheld letter had been written by the partner 


of the deceased (the Informant) in response to a letter from 
the GRO asking her to clarify information she had provided to 
them at an earlier ‘question and answer’ session. 


The Tribunal noted that: 


e the GRO’s letter did not give a specific undertaking of 
confidentiality to the Informant, and 


e the Informant’s response wasn’t marked as being 
provided on condition it would remain confidential. 


However, the Tribunal did accept that the information obtained 
by the GRO during the ‘question and answer’ session was 
subject to a duty of confidence, and also that the contents of 
the Informant’s letter were connected to the information 
provided at that session. 


It therefore concluded that the informant’s letter was subject 
to an implied duty of confidence. 


‘We are satisfied that the Informant is entitled to assume that 
the information given at the question and answer session (in 
so far as it does not appear on the death certificate) is to be 
kept in confidence and that this letter having been obtained in 
relation to a request to clarify the information given at that 
meeting, that the Informant would expect the subsequent 
provision of information arising out of that meeting to be 
treated similarly. We are therefore satisfied that the nature of 
and circumstances in which the information was provided gave 
rise to an implied obligation of confidence.’ (Para 55) 


Example 
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54. 


55. 


56. 


Bristol City Council v ICO & Portland and Brunswick Squares 
Association (EA/2010/0012, 24 May 2010) concerned a 
request for a viability report and feasibility costs estimate 
relating to a proposed building development. The requested 
information had been provided to the Council in support of a 
planning application from a developer. 


The Council refused the request on the grounds that the report 
consisted of commercially sensitive information, the disclosure 
of which would be a breach of confidence. 


The Tribunal accepted the Council’s submissions that it was 
usual practice for viability reports and or other documents 
containing costings to be accepted in confidence (irrespective 
of the reasons for which they were provided), and ruled that 
the report and estimate were subject to a duty of confidence. 


‘../n view of our findings...that at the relevant time the usual 
practice of the Council was that viability reports and cost 
estimates like those in question were accepted in confidence 
(apparently without regard to the particular purpose for which 
they were being provided)...we have reached the conclusion 
that the developer did have reasonable grounds for providing 
the information to the Council in confidence and that any 
reasonable man standing in the shoes of the Council would 
have realized that that was what the developer was doing. In 
these circumstances, an obligation of confidence was imposed 
on the Council by law in relation to the...viability report and 
cost estimate and, it follows, they were therefore “subject to 
confidentiality provided by law”. (Para 12) 


Detriment to the confider 


Although Judge Megarry’s ruling in Coco V Clark included 
consideration of the ‘detriment’ test, it left open the question of 
whether detriment to the confider is a necessary prerequisite in 
every breach of confidence case. 


Since then, further developments in case law have established 
that information about an individual’s private and personal life 
can be protected by the law of confidence, even if disclosure 
would not result in any tangible loss to the confider. 


Furthermore, case law also now suggests that any invasion of 
privacy resulting from a disclosure of private and personal 
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information can be viewed as a form of detriment in its own 
right. 


Example 


In Bluck v ICO and Epsom and St Helier University NHS Trust 
(EA/2006/0090, 17 September 2007), the requester had 


asked the Trust for all the information it held about her 
deceased daughter, including her health records. The Trust 
withheld the information under Section 41. 


At the Tribunal, the requester’s counsel argued that a claim 
for a breach of confidence could not succeed because the 
deceased and her estate would be unlikely to suffer any 
detriment from disclosure. 


The Tribunal refuted this argument, pointing out that previous 
case law had established that it was not necessary to show 
detriment in cases where the requested information concerned 
private matters. 


‘We have already set out extracts from the judgments in both 
Coco v Clark and AG v Guardian which questioned the 
requirement for detriment as an essential ingredient of the 
cause of action in all circumstances. In Ash v McKennitt the 
Court of Appeal...went on to apply the law to the facts of the 
case before it, which involved private information about an 
individual...It did not require any detriment to be established 
beyond the fact that there had been an invasion of the 
Claimant’s privacy and home life. We believe that the principle 
to be drawn from this is that, if disclosure would be contrary 
to an individual's reasonable expectation of maintaining 
confidentiality in respect of his or her private information, then 
the absence of detriment in the sense apparently 
contemplated in the argument presented on behalf of the 
Appellant, is not a necessary ingredient of the cause of action. 
As the Medical Records do fall within the meaning of the 
phrase "private information" the claim for breach of confidence 
would not in our view therefore be defeated on this ground...” 
(Para 15 ) address 


57. In practical terms, this means that, where the information 


relates to a personal or private information matter, the 
authority won’t be required to demonstrate that the confider 
would suffer any tangible detriment from disclosure (such as 
financial loss). 
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58. 


59. 


However, authorities shouldn’t interpret this to mean that they 
can completely disregard the third limb of Judge Megarry’s test 
if the information is personal or private. This is because they 
will still have to show that disclosure would be an unauthorised 
use of the information. 


If the requested information is commercial in nature then the 
disclosure will only constitute a breach of confidence if it would 
have a detrimental impact on the confider. 


Example 


In Higher Education Funding Council for England v ICO & 
Guardian News and Media Ltd (EA/2009/0036, 13 January 


2010) the requester had asked the Higher Education Funding 
Council for England (HEFCE) for various pieces of information 
it held about HEI’s (Higher Education Institutions). HEFCE 
refused this request under Section 41. 


The matter was then referred to the Commissioner who ruled 
that a breach of confidence wouldn’t be actionable because the 
HEIs wouldn’t suffer any detriment from disclosure. 


At the Tribunal, HEFCE submitted that detriment was not an 
independent requirement for a breach of confidence. The 
Commissioner argued that the only cases where detriment 
isn’t a requirement are those concerning private, personal 
information. 


The Tribunal, acknowledged that there had been a divergence 
in the way in which the courts handled cases involving 
commercial information and those involving private 
information. However, it also confirmed that detriment is still a 
necessary element of a claim for breach of confidence in 
relation to commercial information. 


‘The establishment of this distinction seems to have led some 
to doubt whether the test applied in cases of commercial 
information is still appropriate and, in particular, whether the 
requirement to show detriment should be retained. The 
existence of any such doubt does not, however, tempt us to 
follow the HEFCE’s invitation to conclude that, regardless of 
whether the relevant information affects individual privacy, 
detriment is either not required or any requirement is satisfied 
by the fact of unauthorised disclosure. We feel sure that, for 
the time being, this Tribunal, when dealing with the type of 


information in question in this Appeal, should not depart from 
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60. 


the line of authority from the higher courts leading from Coco 
v Clark up to and including Vestergaard.’ 


We conclude, therefore, that the HEFCE must prove detriment 
flowing from disclosure before the hypothetical cause of action 
may be said to have been established (and the exemption 
thereby triggered).’ (Paras 43 & 44) 


It therefore follows that, for commercial information, the 
authority will be expected to put forward an explicit case for 
detriment. Usually the detriment to the confider in such cases 
will be a detriment to the confider’s commercial interests. 


A legal person must be able to bring an action for breach 
of confidence 


61. 


62. 


Section 41(b) provides that the breach of confidence must be 
actionable by either the legal person who gave the information 
to the public authority, or by any other legal person. 


This means that when considering whether a disclosure would 
constitute a breach of confidence an authority may consider the 
expectations of, and the impact on, both: 


e the person who gave the information directly to the public 
authority, and 


e any other previous confiders of confidential material within 
the requested information. 


Example 


A school provides a local authority with a copy of a confidential 
report concerning the levels of truancy amongst its pupils. A 
local newspaper subsequently makes an FOIA request to the 
authority for a copy of this report. 


This report includes names of the pupils concerned and 
contains details of the disciplinary measures taken against 
them. It also contains information that the parents of the 
pupils concerned gave to the school ‘in confidence’. 


In this case, the authority could not only take into account 
whether disclosure would breach the school’s confidence, but 
also whether the parents who confided in the school would be 
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63. 


64. 


65. 


66. 


67. 


68. 


able to take court action against the authority for breaches of 
their confidence. 


In effect, if confidential information has passed through several 
hands, more than one duty of confidence may arise, which 
could lead to more than one potential breach of confidence. It 
is not necessary for the authority to establish that a particular 
person would be likely to bring a claim for breach of 
confidence, only that a person would be able to do so. 


In certain circumstances, the duty of confidence owed to a 
living individual will continue after their death. 


This principle will be of particularly relevance for those 
authorities who hold records about an individual’s personal 
details, such as health records, banking details or the provision 
of care. 


Where a legally enforceable duty of confidentiality is owed to a 
living individual, after death it can be enforced by the 
deceased's personal representative. 


It won’t be necessary for the authority to establish the identity 
of the personal representative, indeed there may be no one 
appointed to the position at that time. However, it has to be 
satisfied that, if such a representative existed, they would be 
capable of taking action. 


More detailed information about the application of Section 41 
where the confider is deceased can be found in our guidance; 
‘Information about the deceased’. 


The action for breach of confidence must be likely to 
succeed 


69. 


70. 


The final part of the test for engaging section 41 is whether the 
action for breach of confidence is likely to succeed. This is 
supported by the statements made by Lord Falconer (the 
promoter of the legislation), during a debate on the Freedom of 
Information Bill. 


"Actionable', means that one can go to court and vindicate a 
right in confidence in relation to that document or information. 
It means being able to go to court and win." (Hansard HL 
(Series 5), Vol.618, col.416) 
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7i. 


72. 


73. 


74. 


75. 


76. 


Td. 


78. 


",.. the word "actionable" does not mean arguable ... It means 
something that would be upheld by the courts; for example, an 
action that is taken and won. Plainly, it would not be enough to 
say, "I have an arguable breach of confidence claim at common 
law and, therefore, that is enough to prevent disclosure". That 
is not the position. The word used in the Bill is "actionable" 
which means that one can take action and win." (Hansard 
Vol.619, col. 175-176). 


Section 41 is an absolute exemption, so there is no public 
interest test to be carried out under FOIA. 


However, the authority will need to carry out a test to 
determine whether it would have a public interest defence for 
the breach of confidence. 


This is because case law on the common law of confidence 
suggests that a breach of confidence won’t succeed, and 
therefore won't be actionable, in circumstances where a public 
authority can rely on a public interest defence. 


The courts used to take the position that the public interest in 
maintaining confidentiality could only be overridden on 
exceptional grounds, for example if the information would bring 
to light evidence of misconduct, illegality or gross immorality. 


However, this began to change following the Court of Appeal 
decision in London Regional Transport v The Mayor of London 
[2001] EWCA Civ 1491; [2003] EMLR 88, as this left open the 
question of whether exceptional grounds are a prerequisite for 
a public interest defence to succeed. 


This ruling was subsequently interpreted by the Information 
Tribunal in Derry City Council V ICO (EA/2006/0014, 11 
December 2006) to mean that an exceptional case is no longer 
required to override a duty of confidence that would otherwise 
exist. 


Further case law has recognised the need to incorporate the 
provisions of the HRA into the test of confidence. The relevant 
provisions, in terms of the public interest, are the Article 8 right 
to privacy and a family life and the competing Article 10 right 
to freedom of expression (which includes the freedom to 
receive and impart information and ideas). 


The effect of these developments around the law of confidence 
has been to modify the public interest test into a test of 
proportionality. 
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79. This was acknowledged by the Court of Appeal in HRH Prince of 
Wales V Associated Newspapers Limited [2008] Ch 57 when it 
stated; 


‘Before the Human Rights Act came into force the 
circumstances in which the public interest and publication 
overrode a duty of confidence were very limited. The issue is 
whether exceptional circumstances justified disregarding the 
confidentiality that would otherwise prevail. Today the test is 
different. It is whether a fetter of the right of freedom of 
expression is, in the particular circumstances, “necessary in a 
democratic society”. It is a test of proportionality...’ (Para 67) 


80. The test now, therefore, is whether there is a public interest in 
disclosure which overrides the competing public interest in 
maintaining the duty of confidence. 


81. This test doesn’t function in the same way as the public interest 
test for qualified exemptions, where the public interest 
operates in favour of disclosure unless outweighed by the 
public interest in maintaining the exemption. Rather, the 
reverse is the case. The test assumes that the public interest in 
maintaining confidentiality will prevail unless the public interest 
in disclosure outweighs the public interest in maintaining the 
confidence. 


82. The key public interest factors inherent in this part of the test 
for Section 41 are summarised below. 


Public interest defence arguments 


83. Some weight should always be afforded to the general public 
interest in ensuring that public authorities remain transparent, 
accountable and open to scrutiny, for example where disclosure 
would: 


e further public understanding of, and participation in the 
debate of issues of the day; 


o enable individuals to understand decisions made by public 
authorities affecting their lives and, in some cases, assist 
individuals in challenging those decisions; or 


° facilitate accountability and transparency in the spending 
of public money. 
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84. Whether this will be enough to provide an adequate public 
interest defence to a breach of confidence will depend upon the 
facts of the case. However, in cases where the duty of 
confidence protects a person’s private interests, it is hard to 
envisage circumstances where the public interest in 
transparency and accountability alone, would be sufficient to 
override the public interest in maintaining that individual’s 
privacy. 


85. If the information would reveal evidence of misconduct, 
illegality or gross immorality (such as misfeasance, 
maladministration or negligence) then this will carry significant 
public interest weight in favour of disclosure. 


86. It is not necessary to establish as a matter of fact that 
wrongdoing has occurred. Indeed, an allegation of wrongdoing 
will also carry some public interest weight, provided it 
originates from a credible source. This is supported by the 
Tribunal Decision in Moss v ICO and the Home Office 
(EA/2011/0081, 28 February 2011).*...the fact of wrongdoing is 
not a necessary prerequisite. Even an allegation of wrongdoing 
will justify exposure in the public interest if the allegation is a 
credible one from an apparently reliable source...’ (para 86). 


87. Some weight may also be afforded to the public interest in 
disclosure if releasing the material would serve to protect 
public safety, for example by raising public awareness of a 
potential danger or threat, or by helping keep the public from 
harm in some way. 


Arguments in favour of maintaining the confidence 


88. When considering the public interest in favour of maintaining 
the confidence, the authority should pay particular regard to: 


G the wider public interest in preserving the principle of 
confidentiality, and 


ə the impact of disclosure on the interests of the confider. 
These factors are addressed in more detail below. 


89. Any disclosure of confidential information will to some degree, 
undermine the principle of confidentiality and the relationship 
of trust between public authorities and confiders of information. 
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90. 


91. 


92. 


93. 


94. 


Individuals and organisations may be discouraged from 
confiding in public authorities if they don’t have a degree of 
certainty that this trust will be respected. 


The weight carried by this factor will depend upon on the 
context and, more specifically, how the relationship of trust 
operates to serve the public interest. 


In a medical context, for example, the principle of 
confidentiality is important because it reinforces the bond of 
trust between patients and doctors, without which people may 
be reluctant to seek medical advice. 


A further example would be an authority which relies on the 
free flow of confidential information from the public to perform 
its statutory functions. Here, the relationship of trust serves to 
maintain that flow of information. 


If the authority was to breach this trust then the flow of 
information could diminish, making it more difficult for the 
organisation to carry out its functions effectively. 


Example 


A member of the public has concerns over the safety of a 
product sold by a local company and writes to the trading 
standards department of her local authority to complain. She 
does this on the understanding that her complaint will be 
treated in confidence. 


The local authority informs the company that they have 
received a letter of complaint about the product. The company 
then submits an FOIA request to the local authority for a copy 
of the complainant’s letter. 


If the local authority was to breach the complainant’s 
confidence by releasing the letter, then it could deter other 
members of the public from bringing consumer complaints to 
its attention. 


This in turn would make it more difficult for the local authority 
to enforce consumer and trading laws in the local area. 


Clearly it wouldn’t be in the wider public interest for the 
authority’s consumer protection functions to be impeded in 
this way. 
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95. The impact on the interest of the confider could take the form 


96. 


of a commercial impact (if the confider is an organisation) or 
loss of privacy (where the confider is a private individual acting 
in a personal capacity). 


In respect of commercial impact, this is most likely to carry 
weight if the breach of confidence would damage the confider’s 
competitive position or ability to compete, for example where 
disclosure would: 


o reveal information that would assist competitors; 


G undermine the confider’s future negotiations with the 
authority or other organisations; or 


° negatively impact on the confider’s relationship with the 
authority or other organisations. 


Example 


Decision Notice FS50496241 concerned a request to the 
University of Sussex for a copy of a business case containing 
proposals to outsource catering and facilities management. 


The University initially withheld the report under Sections 41 
and 43 of FOIA. However, during the course of the 
Commissioner’s investigation it decided to disclose the 
majority of the content and apply Section 41 to the remainder. 


The withheld content contained material provided by a number 
of external suppliers, including information about their 
experience and approaches to business. 


The suppliers were concerned that the disclosure of this 
information would allow their competitors to gain a 
competitive edge over them when trying to win over potential 
clients and submitting offers. 


The Commissioner took into account the potential commercial 
impact on the suppliers when he came to consider the balance 
of the public interest; 


‘..the majority of the report in question has now been 
released- the only information that remains is 
information that was supplied to the university on a 
confidential basis and which would be likely to cause 
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97. 


98. 


99, 


100. 


commercial detriment to those firms that supplied it if it were 
to be released...’ 


The Commissioner has accepted that disclosure could cause 
the remaining suppliers concerned commercial detriment and 
he does not consider there is any overwhelming further public 
interest in this case that would warrant prejudicing the ability 
of these firms to compete.’ (Paras 37 & 38) 


If the information was confided by an individual acting in a 
personal capacity, for example: 


e a resident’s letter of complaint to a council regarding a 
noisy neighbour; 


G a parent’s application for child benefit; or 


G information imparted by a patient during a doctor's 
surgery. 


then the authority may take into account the likely impact of 
disclosure on that person. 


The real impact of disclosing private, personal information will 
be an infringement of the confider’s privacy, and there is a 
strong public interest in protecting the privacy of individuals. 


This public interest is further underpinned by the Article 8 right 
to privacy, and the fact that the courts are obliged to interpret 
the law of confidence in a manner that respects that right. 


Authorities should also note that, where the impact on privacy 
is a factor, there is likely to be some overlap with the other 
public interest factors in favour of maintaining the confidence. 
This is because any infringement of privacy may deter others 
from providing information to the authority in question. This in 
turn could work against the public interest by hampering that 
authority’s ability to carry out its functions (see Section above 
entitled ‘The wider public interest in preserving the principle of 
confidentiality’. ) 


Protectively marked information 


101. 


Often, central government departments (and some other 
authorities) will make use of systems of protective markings 
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102. 


103. 


104. 


105. 


106. 


107. 


(e.g. Official - Sensitive, Secret and Top Secret) to indicate 
that information is confidential. 


However, whilst protective markings may provide a useful 
preliminary indication that information may be confidential, 
authorities should not rely on them to make final decisions. 


For example, circumstances can change with the passage of 
time, and information which was considered worthy of 
protection at the time of its creation may have lost that quality 
of confidence by the time of the request. 


Also, it is not guaranteed that information that is protectively 
marked will meet the test under section 41 (for example it may 
not have been obtained from another person). 


If protective marking systems are to be of assistance it may be 
necessary to also record the period of time for which the 
marking is anticipated to be relevant together with any other 
information that might assist an FOI decision maker. 


Similar considerations will apply to information that has been 
provided to an authority marked, ‘Confidential’ or ‘Commercial 
in Confidence’ and so on. Very often such markings do not 
provide a good indication of whether information has the 
necessary “quality of confidence”. 


As with internal markings, what was confidential at the time of 
writing may no longer be at the time of a request for disclosure 
and all the requirements of section 41 may not be met. If in 
doubt it will be sensible to check the position with the provider 
of the information and any other affected parties, bearing in 
mind that it is the authority and not a third party that must 
decide if the exemption is relevant. 


Information shared between government departments 


108. 


109. 


In cases where the authority and confider are both government 
departments (or two Northern Ireland departments), the 
confider would not be able to rely upon this exemption. 


This is because Section 81(2)(b) of FOIA precludes government 
departments from relying on Section 41(b) in respect of 
information provided in confidence by other government 
departments. However, this wouldn’t prevent the department 
that obtained the information from relying on other 
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exemptions, where applicable (see later section entitled 
‘Interaction between Section 41 and other exemptions’). 


Interaction between section 41 and other exemptions 


110.If the confidential material contains information about 
identifiable individuals then there is likely to be some overlap 
with Section 40 (the exemption for personal information). 


111.Further information on the application of Section 40 can be 


found in our guidance Personal information (section 40 and 
regulation 13). 


112.Where the information is of a commercial nature, there may be 
some overlap with Section 43 (the exemption for commercial 
interests) if: 


° disclosure would be likely to prejudice the commercial 
interests of any person (as in a ‘legal person’); or, 


° the information constitutes a trade secret. 


113.This is covered in more detail in our guidance Commercial 
Interests. 


114.Whilst confidential information provided by one government 
department to another is unlikely to fall under Section 41, it 
may be relevant to consider other exemptions, such as those 
relating to defence, the economy or prejudice to the effective 
conduct of public affairs. 


115.Information which a court might find was subject to an 
obligation of confidence because it had been obtained using 
statutory powers, may also be protected by the exemptions 
relating to investigations and proceedings, law enforcement or 
public audit. 


116.These examples are not exhaustive. Other exemptions may 
apply. As always it is the specific circumstances of the case 
that will dictate the application of exemptions. 


117.This guidance relates only to FOIA. If the information is 
environmental, public authorities will instead need to consider 
exceptions under the EIR. 
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Duty to confirm or deny 


41.—(2) The duty to confirm or deny does not arise if, or to 
the extent that, the confirmation or denial that would have to 
be given to comply with section 1(1)(a) would (apart from this 
Act) constitute an actionable breach of confidence. 


118.Section 1(1)(a) of FOIA places public authorities under a duty 
to confirm or deny whether they hold the requested 
information. 


119.However, Section 41(2) provides an exclusion from this duty 
where the act of confirming or denying the existence of the 
information would itself result in an actionable breach of 
confidence. This provides the authority with the option to issue 
a neither confirm nor deny (NCND) response in such cases. 


120.The test for an actionable breach of confidence in section 
41(1)(a) is the same as in section 41(1)(b). This means that 
an authority can only rely on an NCND response if it wouldn’t 
have a public interest defence against the breach of confidence 
that would result from a confirm or deny response. 


Managing expectations of confidentiality when contracting 
or corresponding with third parties 


121.Part V of the Section 45 Code of Practice outlines good practice 
regarding a public authority’s confidentiality obligations relating 
to contracts under FOIA. However, two points we would like to 
highlight in particular are: 


e When a public authority enters into a contract, it should let 
that other party know before the contract is drawn up that 
part or all of the contract may be disclosed in response to 
a freedom of information request. 


e Public authorities can use confidentiality clauses to identify 
information that may be exempt, but they should carefully 
consider the compatibility of such clauses with their 
obligations under FOIA. They may also help identify 
occasions where the other party to a contract should be 
consulted before disclosure. Such clauses cannot however 
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122. 


prevent disclosure under FOIA if the information is not 
confidential. 


Similarly, when corresponding with third parties, public 
authorities should think carefully before giving assurances of 
confidentiality. They should manage expectations by explaining 
the limits that FOIA may place upon its ability to withhold 
information provided to it in confidence. 


More information 


123. 


124. 


125. 


126. 


Additional guidance is available on our guidance pages if you 
need further information on the public interest test, other FOIA 
exemptions, or EIR exceptions. 


This guidance has been developed drawing on ICO experience. 
Because of this it may provide more detail on issues that are 
often referred to the Information Commissioner than on those 
we rarely see. The guidance will be reviewed and considered 
from time to time in line with new decisions of the Information 
Commissioner, Tribunals and courts. 


It is a guide to our general recommended approach, although 
individual cases will always be decided on the basis of their 
particular circumstances. 


If you need any more information about this or any other 
aspect of freedom of information, please contact us, or visit our 


website at www.ico.org.uk. 
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